# Visual Portfolio, Photo Gallery & Post Grid <= 3.8.2 - Authenticated (Subscriber+) Missing Authorization via Multiple AJAX Actions

- **ID:** WPSEC-2026-1640
- **Plugin:** Gallery by Visual Portfolio (`visual-portfolio`), https://wordpress.org/plugins/visual-portfolio/
- **Affected versions:** all versions before 3.9.0
- **Fixed in:** 3.9.0 (Update to 3.9.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/visual-portfolio
- **Fix released:** 2026-10-24
- **Published:** 2026-10-25
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1640/

## Description

The Gallery by Visual Portfolio plugin for WordPress is vulnerable to unauthorized access via the vp_dynamic_control_callback and vp_find_oembed AJAX actions in all versions up to, and including, 3.8.2, due to missing capability checks on handlers that only verified the 'vp-ajax-nonce' nonce, which is printed on every admin page, including the profile page any logged-in user can open. This makes it possible for authenticated attackers, with subscriber-level access and above, to search the titles of draft, pending and scheduled posts of any author, list post types and terms, and make the site perform oEmbed lookups.

## References

- https://wpsec.com/vuln/WPSEC-2026-1640/
- https://plugins.svn.wordpress.org/visual-portfolio/tags/3.9.0/
- https://wordpress.org/plugins/visual-portfolio/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1640/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.